SUSE-SU-2026:0892-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20260892-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:0892-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:0892-1
- Upstream
- Related
- Published
- 2026-03-13T09:05:08Z
- Modified
- 2026-03-14T08:15:24.063150Z
- Summary
- Security update for busybox
- Details
-
This update for busybox fixes the following issues:
- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
- CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20260892-1/
- https://bugzilla.suse.com/1192869
- https://bugzilla.suse.com/1217580
- https://bugzilla.suse.com/1217584
- https://bugzilla.suse.com/1217585
- https://bugzilla.suse.com/1241661
- https://bugzilla.suse.com/1253245
- https://bugzilla.suse.com/1258163
- https://bugzilla.suse.com/1258167
- https://www.suse.com/security/cve/CVE-2021-42380
- https://www.suse.com/security/cve/CVE-2023-42363
- https://www.suse.com/security/cve/CVE-2023-42364
- https://www.suse.com/security/cve/CVE-2023-42365
- https://www.suse.com/security/cve/CVE-2025-46394
- https://www.suse.com/security/cve/CVE-2025-60876
- https://www.suse.com/security/cve/CVE-2026-26157
- https://www.suse.com/security/cve/CVE-2026-26158
Affected packages
SUSE:Linux Enterprise Server 12 SP5-LTSS / busybox
Package
- Name
- busybox
- Purl
- pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS